github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Safer, nicer, uniform Debian initd script

pull/2348/head
Viktor Szépe 2018-10-12 22:08:31 +02:00
parent 5a54a44559
commit dfd2a2063d
1 changed files with 70 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

84
files/debian-initd
View File

@ -22,28 +22,28 @@
# rename this file: (sudo) mv /etc/init.d/fail2ban.init /etc/init.d/fail2ban # rename this file: (sudo) mv /etc/init.d/fail2ban.init /etc/init.d/fail2ban
# same with the logrotate file: (sudo) mv /etc/logrotate.d/fail2ban.logrotate /etc/logrotate.d/fail2ban # same with the logrotate file: (sudo) mv /etc/logrotate.d/fail2ban.logrotate /etc/logrotate.d/fail2ban
# #
PATH=/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin PATH="/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin"
DESC="authentication failure monitor" DESC="Authentication failure monitor"
NAME=fail2ban NAME="fail2ban"
# fail2ban-client is not a daemon itself but starts a daemon and # fail2ban-client is not a daemon itself but starts a daemon and
# loads its with configuration # loads its with configuration
DAEMON=/usr/local/bin/$NAME-client DAEMON="/usr/local/bin/$NAME-client"
SCRIPTNAME=/etc/init.d/$NAME SCRIPTNAME="/etc/init.d/$NAME"
# Ad-hoc way to parse out socket file name # Ad-hoc way to parse out socket file name
SOCKFILE=`grep -h '^[^#]*socket *=' /etc/$NAME/$NAME.conf /etc/$NAME/$NAME.local 2>/dev/null \ SOCKFILE="$(grep -h '^[^#]*socket *=' "/etc/$NAME/$NAME.conf" "/etc/$NAME/$NAME.local" 2>/dev/null \
| tail -n 1 | sed -e 's/.*socket *= *//g' -e 's/ *$//g'` | tail -n 1 | sed -e 's/.*socket *= *//g' -e 's/ *$//g')"
[ -z "$SOCKFILE" ] && SOCKFILE='/var/run/fail2ban.sock' [ -z "$SOCKFILE" ] && SOCKFILE="/var/run/fail2ban.sock"
# Exit if the package is not installed # Exit if the package is not installed
[ -x "$DAEMON" ] || exit 0 [ -x "$DAEMON" ] || exit 0
# Run as root by default. # Run as root by default.
FAIL2BAN_USER=root FAIL2BAN_USER="root"
# Read configuration variable file if it is present # Read configuration variable file if it is present
[ -r /etc/default/$NAME ] && . /etc/default/$NAME [ -r "/etc/default/$NAME" ] && . "/etc/default/$NAME"
DAEMON_ARGS="$FAIL2BAN_OPTS" DAEMON_ARGS="$FAIL2BAN_OPTS"
# Load the VERBOSE setting and other rcS variables # Load the VERBOSE setting and other rcS variables
@ -51,7 +51,8 @@ DAEMON_ARGS="$FAIL2BAN_OPTS"
# Predefine what can be missing from lsb source later on -- necessary to run # Predefine what can be missing from lsb source later on -- necessary to run
# on sarge. Just present it in a bit more compact way from what was shipped # on sarge. Just present it in a bit more compact way from what was shipped
log_daemon_msg () { log_daemon_msg()
{
[ -z "$1" ] && return 1 [ -z "$1" ] && return 1
echo -n "$1:" echo -n "$1:"
[ -z "$2" ] || echo -n " $2" [ -z "$2" ] || echo -n " $2"
@ -68,7 +69,7 @@ log_daemon_msg () {
# #
report_bug() report_bug()
{ {
echo $* echo "$*"
echo "Please submit a bug report to Debian BTS (reportbug fail2ban)" echo "Please submit a bug report to Debian BTS (reportbug fail2ban)"
exit 1 exit 1
} }
@ -119,10 +120,10 @@ do_start()
# Create the logfile if it doesn't exist # Create the logfile if it doesn't exist
touch /var/log/fail2ban.log touch /var/log/fail2ban.log
chown "$FAIL2BAN_USER" /var/log/fail2ban.log chown "$FAIL2BAN_USER" /var/log/fail2ban.log
find /proc/net/xt_recent -name 'fail2ban-*' -exec chown "$FAIL2BAN_USER" {} \; find /proc/net/xt_recent -name "fail2ban-*" -exec chown "$FAIL2BAN_USER" "{}" ";"
fi fi
start-stop-daemon --start --quiet --chuid "$FAIL2BAN_USER" --exec $DAEMON -- \ start-stop-daemon --start --quiet --chuid "$FAIL2BAN_USER" --exec "$DAEMON" -- \
$DAEMON_ARGS start >/dev/null \ $DAEMON_ARGS start >/dev/null \
|| return 2 || return 2
@ -137,7 +138,7 @@ do_start()
do_status() do_status()
{ {
$DAEMON ping >/dev/null 2>&1 $DAEMON ping >/dev/null 2>&1
return $? return "$?"
} }
# #
@ -157,11 +158,11 @@ do_stop()
# for server to react on client's stop request. Especially # for server to react on client's stop request. Especially
# important for restart command on slow boxes # important for restart command on slow boxes
count=1 count=1
while do_status && [ $count -lt 60 ]; do while do_status && [ "$count" -lt 60 ]; do
sleep 1 sleep 1
count=$(($count+1)) count="$((count + 1))"
done done
[ $count -lt 60 ] || return 3 # failed to stop [ "$count" -lt 60 ] || return 3 # failed to stop
return 0 return 0
} }
@ -169,8 +170,9 @@ do_stop()
# #
# Function to reload configuration # Function to reload configuration
# #
do_reload() { do_reload()
$DAEMON reload > /dev/null && return 0 || return 1 {
"$DAEMON" reload >/dev/null && return 0 || return 1
return 0 return 0
} }
@ -186,7 +188,7 @@ log_end_msg_wrapper()
value=0 value=0
fi fi
if [ "$3" != "no" ]; then if [ "$3" != "no" ]; then
log_end_msg $value log_end_msg "$value"
fi fi
if [ $value != "0" ]; then if [ $value != "0" ]; then
exit $1 exit $1
@ -198,13 +200,13 @@ case "$command" in
start|force-start) start|force-start)
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
do_start "$command" do_start "$command"
log_end_msg_wrapper $? 255 "$VERBOSE" log_end_msg_wrapper "$?" 255 "$VERBOSE"
;; ;;
stop) stop)
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME" [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
do_stop do_stop
log_end_msg_wrapper $? 255 "$VERBOSE" log_end_msg_wrapper "$?" 255 "$VERBOSE"
;; ;;
restart|force-reload) restart|force-reload)
@ -213,7 +215,7 @@ case "$command" in
case "$?" in case "$?" in
0|1) 0|1)
do_start do_start
log_end_msg_wrapper $? 0 "always" log_end_msg_wrapper "$?" 0 always
;; ;;
*) *)
# Failed to stop # Failed to stop
@ -222,7 +224,7 @@ case "$command" in
esac esac
;; ;;
reload|force-reload) reload)
log_daemon_msg "Reloading $DESC" "$NAME" log_daemon_msg "Reloading $DESC" "$NAME"
do_reload do_reload
log_end_msg $? log_end_msg $?
@ -232,22 +234,36 @@ case "$command" in
log_daemon_msg "Status of $DESC" log_daemon_msg "Status of $DESC"
do_status do_status
case $? in case $? in
0) log_success_msg " $NAME is running" ;; 0)
log_success_msg " $NAME is running"
;;
255) 255)
check_socket check_socket
case $? in case $? in
1) log_failure_msg " $NAME is not running" && exit 3 ;; 1)
0) log_failure_msg " $NAME is not running but $SOCKFILE exists" && exit 3 ;; log_failure_msg " $NAME is not running" && exit 3
2) log_failure_msg " $SOCKFILE not readable, status of $NAME is unknown" && exit 3 ;; ;;
3) log_failure_msg " $SOCKFILE exists but not a socket, status of $NAME is unknown" && exit 3 ;; 0)
*) report_bug "Unknown return code from $NAME:check_socket." && exit 4 ;; log_failure_msg " $NAME is not running but $SOCKFILE exists" && exit 3
esac ;;
2)
log_failure_msg " $SOCKFILE not readable, status of $NAME is unknown" && exit 3
;;
3)
log_failure_msg " $SOCKFILE exists but not a socket, status of $NAME is unknown" && exit 3
;;
*)
report_bug "Unknown return code from $NAME:check_socket." && exit 4
;; ;;
*) report_bug "Unknown $NAME status code" && exit 4
esac esac
;; ;;
*) *)
echo "Usage: $SCRIPTNAME {start|force-start|stop|restart|force-reload|status}" >&2 report_bug "Unknown $NAME status code" && exit 4
;;
esac
;;
*)
echo "Usage: $SCRIPTNAME {start|force-start|stop|restart|force-reload|status}" 1>&2
exit 3 exit 3
;; ;;
esac esac